Anthropic ships Claude Fable 5.1 and Mythos 5.1 with prompt-injection guardrails and an invisible watermark

Long-context writing models land, with a posture change for shared documents

Anthropic introduced Claude Fable 5.1 and Claude Mythos 5.1 on September 14, 2026 as long-context writing and editing models. Alongside the release, the Claude client treats a page authored by someone else as untrusted content and flags any instructions embedded in that page instead of executing them. The posture change is documented as part of client behaviour since v2.1.265, which shipped on September 8. For practitioners who paste collaborator drafts into Claude for editing, this means prompts that rely on imperative lines inside the pasted text — "rewrite in the active voice", "remove section three" — will surface as instructions the model declined to follow rather than as silent edits.

An invisible watermark is being baked into Claude's text output

In August 2026, Anthropic announced that future Claude models would add information into the text they generate to create a trackable watermark. BGR framed the change as part of a pattern of reasons users have drifted away from Claude. The watermarking policy sits alongside the prompt-injection guardrail: both reshape the trust assumptions an editor makes when accepting Claude output into a workflow. Editors who republish Claude-assisted drafts into CMS systems, citation chains or client deliverables now have to reason about a hidden signal in the prose they did not write.

Custom skills were repurposed into a voice-cloning propaganda pipeline

Anthropic's September 2026 threat intelligence report details an incident in which the Claude custom-skills feature was turned into a voice-cloning propaganda factory. The pipeline cloned the voices of three Iranian writers and prepared narratives in advance. The disclosure matters to text practitioners because the entry point was a writing-and-skills feature, not a voice API: the misuse crossed from text authoring into synthetic media while still riding on document-editing tooling. It is a concrete example of how writing assistants with extensibility become dual-use surfaces.

What the changes mean for drafting, editing and review workflows

Two practical shifts land at once. First, an editor pasting a collaborator's draft into Claude can no longer rely on imperative instructions inside that draft being executed; any reviewer prompts need to live in the chat box, not in the document. Second, Claude-generated text now carries a watermark that downstream readers, publishers or detection tooling can in principle identify.

Reviewers handling compliance-sensitive copy — regulatory filings, academic submissions, legal memos — should expect provenance checks on Claude-assisted paragraphs to become routine. Pairing Claude output with a tool that strips stray formatting before it enters a CMS will keep the workflow auditable; a strikethrough helper and a formatting remover cover the two clean-up steps editors reach for first.

What practitioners can check next

Three checkpoints follow from the evidence. 1 release notes for the specific long-context limits, prompt-injection flag wording and any default-on or default-off state for the invisible watermark on text outputs. Re-test collaborative editing flows that previously relied on imperative lines inside pasted drafts, and move those instructions into the chat surface.

For teams localising Claude-assisted copy, the same watermark signal travels through translation pipelines, so detection tooling should be evaluated against translated output as well as English originals. No further release date for the watermark rollout or for any revised skills policy is named in the available evidence, so subsequent checks should track Anthropic's threat intelligence and model release notes rather than a calendar date.